Information Security Threat and Risk Assessments in DevOps

Information Security (IS) is becoming increasingly important in a modern digitalized world. Almost anything can be done online, which has become an opportunity for cyber incidents. Risk analysis and threat modeling are ways to find and mitigate risks and threats in organizations and its assets. DevOps is also becoming increasingly popular in software development. The idea of DevOps is to make the software development process faster and more efficient. One of DevOps' practices is security, yet there have still been problems with incorporating security into DevOps. This thesis studies different kinds of threat modeling and risk analysis methods. The methods are presented and then analyzed according to their features. The methods are ISO 27005, CORAS, OCTAVE, FAIR, STRIDE and CTM. The results of this study show that there is no absolute answer on which one is the best for DevOps processes. There were good factors in all the methods, but they also all had room for improvement. Therefore, the thesis cannot claim that there would be one perfect assessment method in the studied methods. ISO 27005 is considered as a good overall method for risk analysis, although there needs to be more studies on its compatibility for DevOps. STRIDE was often used with DevOps, but it has its downsides. The "shift left" and especially continuity have been noticed to be a good factor in threat and risk assessment methods. Continuous Threat Modeling is a new unstudied analysis method, that has a very promising idea when thinking about DevOps. Security in DevOps and especially risk analysis and threat modeling are subjects that should be researched more in the future.Tietoturvallisuudesta on tullut todella tärkeä asia digitalisoituvassa maailmassa. Melkein mitä tahansa pystytään tehdä internetissä, mikä on luonut mahdollisuuden kyberonnettumuuksille. Riskianalyysit sekä uhkamallintaminen ovat tapoja eliminoida riskejä ja uhkia organisaatioissa ja suojella organisaation omaisuutta. DevOps on myös kasvattanut suosiotaan ohjelmistokehityksessä. Sen ideana on tiivistettynä tuottaa nopeasti ja tehokkaasti uutta koodia ohjelmistokehityksessä. Vaikka DevOpsin yksi ominaisuuksista on tietoturva, on sen sisällyttämisessä ilmennyt ongelmia. Tässä kandidaatintyössä käydään läpi erilaisia uhkamallinnus- sekä riskianalyysitapoja, ja niiden soveltuvuutta DevOpsiin. Aluksi käsitellään kirjallisuuskatsaukseen liittyvää teoriaa, jonka jälkeen siirrytään analyysitekniikoihin ja niiden ominaisuuksiin. Tutkielmassa esitellään kuusi erilaista riskianalyysi- tai uhkamallinnusmetodia. Nämä metodit ovat ISO 27005, CORAS, OCTAVE, FAIR, STRIDE sekä CTM. Metodit on valittu niiden hyvän dokumentoinnin takia, ja lisäksi tulevaisuutta ajatellen on mukaan otettu uudempi, vähemmän tutkittu CTM-metodi. Opinnäytteen tutkimusten mukaan ei ole yhtä oikeaa tapaa tehdä riskianalyysejä. Analyysien jatkuvuuden on huomattu olevan yksi tärkeä tekijä DevOps-ympäristöissä. Lisäksi esimerkiksi yhteisöllisyyden, nopeuden ja turvallisuuden on sanottu olevan tärkeitä DevOpsissa. Continuous Threat Modeling:n idea vastaa jatkuvuuskysymykseen, vaikka onkin uusi ja huonosti tutkittu metodi. ISO 27005 todettiin hyväksi yleisanalyysimetodiksi. STRIDE:ä on usein käytetty DevOpsin kanssa. Kaikista työssä tutkituista metodeista löytyi jotakin hyvää ja jotakin parannettavaa, joten ei voida varmasti sanoa absoluuttista parasta metodia DevOpsiin. DevOpsiin liittyvään tietoturvaan, etenkin uhkamallintamiseen ja riskianalyyseihin, tulisi tehdä lisää tutkimusta tarkempien tuloksien saamiseksi

Exiting the risk assessment maze: A meta-survey

Organizations are exposed to threats that increase the risk factor of their ICT systems. The assurance of their protection is crucial, as their reliance on information technology is a continuing challenge for both security experts and chief executives. As risk assessment could be a necessary process in an organization, one of its deliverables could be utilized in addressing threats and thus facilitate the development of a security strategy. Given the large number of heterogeneous methods and risk assessment tools that exist, comparison criteria can provide better understanding of their options and characteristics and facilitate the selection of a method that best fits an organization’s needs. This paper aims to address the problem of selecting an appropriate risk assessment method to assess and manage information security risks, by proposing a set of comparison criteria, grouped into 4 categories. Based upon them, it provides a comparison of the 10 popular risk assessment methods that could be utilized by organizations to determine the method that is more suitable for their needs. Finally, a case study is presented to demonstrate the selection of a method based on the proposed criteri

Impact of Implementation of Information Security Risk Management and Security Controls on Cyber Security Maturity (A Case Study at Data Management Applications of XYZ Institute)

Information security is an important concern for governments and industry due to the increase in cyber attacks during Covid-19. The government is obliged to maintain information security in implementing an Electronic-Based Government System following Presidential Regulation of the Republic of Indonesia Number 95 of 2018. To overcome this problem, the XYZ Institute needs an approach to implementing information security risk management and information security controls. This study aims to risk identification, risk analysis, risk evaluation, risk treatment, risk acceptance, risk control, and analysis of cyber security maturity gaps in the domain of governance, identification, protection, detection, and response. ISO/IEC 27005:2018 as guidance for conducting risk assessments. The code of practice for information security control uses the ISO/IEC 27002:2013 standard and assessing maturity using the cyber security maturity model version 1.10 developed by the National Cyber and Crypto Agency of the Republic of Indonesia. The results show that the cyber maturity value increased from 3.19 to 4.06 after implementing 12 new security controls

“Be a Pattern for the World”: The Development of a Dark Patterns Detection Tool to Prevent Online User Loss

Dark Patterns are designed to trick users into sharing more information or spending more money than they had intended to do, by configuring online interactions to confuse or add pressure to the users. They are highly varied in their form, and are therefore difficult to classify and detect. Therefore, this research is designed to develop a framework for the automated detection of potential instances of web-based dark patterns, and from there to develop a software tool that will provide a highly useful defensive tool that helps detect and highlight these patterns

Technical Debt is an Ethical Issue

We introduce the problem of technical debt, with particular focus on critical infrastructure, and put forward our view that this is a digital ethics issue. We propose that the software engineering process must adapt its current notion of technical debt – focusing on technical costs – to include the potential cost to society if the technical debt is not addressed, and the cost of analysing, modelling and understanding this ethical debt. Finally, we provide an overview of the development of educational material – based on a collection of technical debt case studies - in order to teach about technical debt and its ethical implication

Minding the Gap: Computing Ethics and the Political Economy of Big Tech

In 1988 Michael Mahoney wrote that “[w]hat is truly revolutionary about the computer will become clear only when computing acquires a proper history, one that ties it to other technologies and thus uncovers the precedents that make its innovations significant” (Mahoney, 1988). Today, over thirty years after this quote was written, we are living right in the middle of the information age and computing technology is constantly transforming modern living in revolutionary ways and in such a high degree that is giving rise to many ethical considerations, dilemmas, and social disruption. To explore the myriad of issues associated with the ethical challenges of computers using the lens of political economy it is important to explore the history and development of computer technology

Proceedings of the ETHICOMP 2022: Effectiveness of ICT ethics - How do we help solve ethical problems in the field of ICT?

This Ethicomp is again organized in exceptional times. Two previous ones were forced to turn to online conferences because of Covid-pandemic but it was decided that this one would be the physical one or cancelled as the need for real encounters and discussion between people are essential part of doing philosophy. We need possibility to meet people face to face and even part of the presentation were held distance–because of insurmountable problems of arriving by some authors– we manage to have real, physical conference, even the number of participants was smaller than previous conferences.The need of Ethicomp is underlined by the way world nowadays is portrayed for us. The truthfulness and argumentation seem to be replaced by lies, strategic games, hate and disrespect of humanity in personal, societal and even global communication. EThicomp is many times referred as community and therefore it is important that we as community do protect what Ethicomp stands for. We need to seek for goodness and be able to give argumentation what that goodness is. This lead us towards Habermass communicative action and Discourse ethics which encourages open and respectful discourse between people (see eg.Habermass 1984;1987;1996). However, this does not mean that we need to accept everything and everybody. We need to defend truthfulness, equality and demand those from others too. There are situations when some people should be removed from discussions if they neglect the demand for discourse. Because by giving voice for claims that have no respect for argumentation, lacks the respect of human dignity or are not ready for mutual understanding (or at least aiming to see possibility for it) we cannot have meaningful communication. This is visible in communication of all levels today and it should not be accepted, but resisted. It is duty of us all.</p